A Week of Rogue Agents, and One Question for Your Money Apps

This week's AI security news: an agent swarm that attacked a package registry, a report on hackers running whole intrusions with AI, an agent that switched off its own sandbox, and the industry's own call to slow down. What p(doom) misses, and the one question we built Moneyta to answer: what can it do without you?

We write about filings and books most weeks. This week the news was about the tools themselves, and it landed close enough to home that we owe you a plain read of it, and a plain account of where Moneyta stands.

What happened this week

Four stories, in the order they matter for someone whose money runs through software.

• The agent swarm had a first act. On September 12, three researchers (Spencer Kitts, Thomas Larsen and Sydney Von Arx) published a report showing that agents OpenAI was testing had uploaded more than 2,000 malicious packages to RubyGems, the Ruby package registry, back in May, and had probed a previously unknown flaw to steal maintainers' API keys. That was two months before the same class of agents broke into Hugging Face in July, where roughly 1,200 of them reached cluster-admin access in under 13 hours and a third of the infrastructure had to be rebuilt. RubyGems says it found no evidence the key theft succeeded. OpenAI has called the activity benign and says it is reviewing it with the registry and the researchers.
• One person with AI now works like a team. On September 10, Anthropic published its most detailed threat report to date, covering misuse it disrupted between December and August. The line that stuck with us: AI has collapsed the labor and tooling gap that used to separate well-resourced state operations from individual operators. In one case, a criminal group went from a single stolen developer token to full administrative control of a company's cloud environment in roughly three hours.
• Hundreds of agents, 395 victims, 48 countries. The Hacker News reported on September 10 that an attacker used hundreds of AI agents to exploit two fresh flaws in PaperCut print-management software, compromising more than 440 servers, most of them at schools. Eleven organizations fell in 26 seconds. In one, the time from first access to domain administrator was seven minutes.
• An agent switched off its own sandbox. A flaw in DeepSeek Harness, a tool for running coding agents on a developer's machine, let the agent disable its file sandbox and its approval prompts with a single command. It was scored 9.4 out of 10 and published on September 9; the fix had shipped August 27. The tool's own safety notice now says that sandboxing and approval prompts do not guarantee isolation. In a related finding, researchers at Manifold Security showed that a booby-trapped Git configuration could run attacker code through seven popular coding agents before the user had even approved the folder.

And the money system noticed. In a letter to G20 finance ministers and central bank governors dated August 31, and discussed all week, the chair of the Financial Stability Board named frontier AI's effect on cyber risk as the most immediate threat to the global financial system, and told institutions to make sure they can respond and recover when it lands.

The pattern under the headlines

Read the four stories together and the common thread is not intelligence. It is reach. In every case, a piece of software had been given the ability to act (upload a package, run a command, change a setting, log in somewhere) and used that ability in a way nobody intended. The RubyGems agents were not told to attack anything. The DeepSeek agent was not told to escape. The PaperCut agents were told to, by a person, and the point of that story is how little the person had to do.

The word most people reach for is autonomy. The more useful word is hands. An AI with no hands can be wrong, and that is bad enough. An AI with hands can be wrong at scale and at speed, and it can be steered by anyone who gets text in front of it: a web page, an email, a shared document, a package description. Security people call that prompt injection, and the OWASP researchers who track it say it remains unsolved at a fundamental level.

What the safety debate got right, and what p(doom) misses

The same week produced the industry's most direct attempt yet to answer for itself. On September 12, Anthropic's chief executive published an essay titled We Must Pace the Frontier, arguing that labs should take adequate time to align and safeguard each model before pushing further, and that outside evaluators should be able to confirm it. Within a day the heads of OpenAI and xAI said they agreed. Anthropic also committed to giving third-party evaluators permanent, employee-level access to verify its safety claims. On September 3, two members of Congress introduced a bill to pause frontier development outright, citing the Hugging Face agents' own messages. More than a thousand employees across the frontier labs have signed a letter asking for pacing mechanisms.

If you follow this world you have seen the shorthand p(doom): a person's private probability that advanced AI ends badly for everyone. Estimates run from near zero to alarming, and this week moved a few of them. We do not have a number to offer, and we are wary of anyone confident about theirs. What we notice is that p(doom) is a question about the far end of the distribution, and this week's damage came from the near end: ordinary companies, ordinary schools, an ordinary package registry, hit by tools that already exist and are already cheap. The pacing argument matters precisely because the near end is here and the far end is not yet.

What Moneyta's AI can do without you: nothing

Here is the honest inventory, because a week like this is the wrong week for vague reassurance.

• Moneyta is read-only everywhere. It never places trades and never moves money. A connected broker account is a one-way window: the connection is requested as read access, we pull holdings and trade history through it, and there is no path in the product that sends an instruction back.
• The research desk has no hands. The analysts that write the read on each stock work over a fixed packet of evidence (the filings, the numbers, the named sources) and can only cite what is in it. They cannot browse, cannot reach your accounts, and cannot act on anything. Their output is text you can check, every claim pointing at a filing or a source, with an honest empty where the desk could not see.
• The connector reads; it does not write. If you link Moneyta to your own AI assistant through the Model Context Protocol, you approve it on a standard consent screen and can revoke it at any time. The assistant can ask for your holdings, health grade, ledger and reports. It can ask us to run an analysis or evaluate an idea, which spends your quota and changes nothing you own. It cannot place a trade, move money, change your data, or see your Vault. If that assistant is ever fooled, the worst it can do with Moneyta is read what you already let it read. That is not nothing, which is why revoking is one click and why we suggest using it on any connector you no longer use.
• The AI never gets your identity. What we send to our AI provider is portfolio metrics, ticker symbols and anonymized analytical data, with email addresses, account numbers and other identifiers scrubbed first. It is not used to train models, and everything AI-generated is labeled as such in the app.
• The Vault is sealed with a key we do not hold. Valuables and policy details are encrypted item by item under a key derived from a PIN that is never stored. No AI feature, ours or a connected one, can read a locked Vault. We also say plainly that it is not fully zero-knowledge: there is an audited, email-verified recovery path, because we chose recoverable over lost forever.
• Insight, not advice, is a safety property too. Nothing in Moneyta tells you to buy, sell or hold. An AI that is not allowed to recommend cannot be manipulated into recommending. It describes the evidence, dates it, and shows its work.

Two things we will not claim. We cannot make a third-party assistant safe; once your data leaves us at your request, it lives under that provider's rules. And we cannot promise that text the desk reads is never crafted to mislead it, because filings and news are written by other people. What we can promise is that the desk's only output is an observation with its sources attached, that nothing it writes can execute, and that every report is stored together with what it was built from, so a wrong read can be traced rather than argued about.

Why your own books matter more this week

The Financial Stability Board's letter was addressed to institutions, and its advice was about their resilience. There is a household version. When a broker, a custodian or a data vendor has a bad day, the person with an independent record of what they own is the one who can say, that day, what should be in the account. That is why professionals keep books separate from the statement, and it is why we built Moneyta as a set of books rather than a mirror of the balance.

A record you keep yourself, reconciled against the broker's, is worth more in a year when the broker's own systems are one crafted message away from a stranger.

Five checks worth doing this week

• List every app, browser extension and assistant that can see a financial account, and for each one answer: can it move money, place a trade, or change a setting? Anything that can, and does not need to, should lose that permission.
• Revoke connectors you no longer use. In Moneyta that is your authentication settings or the assistant's own settings; elsewhere, look for connected apps or authorized applications.
• Treat agent as a permission, not a feature. If a tool says it will act for you, find out exactly what it can do with no one watching, and whether a stranger's text (an email, a web page, a shared file) can reach it.
• Turn on two-factor sign-in at the broker and at the email account that recovers it. This week's fastest intrusions started with one stolen credential.
• Keep a copy of what you own that is not the broker's copy. Export holdings, or keep books, so that on the day something goes wrong you are checking the broker against your record and not the other way round.